diff --git a/index.html b/index.html index 3efd0b8b31..26c4428a9e 100644 --- a/index.html +++ b/index.html @@ -1211,11 +1211,7 @@

6.3.1 report-uri
  • 6.3.2 report-to -
  • - 6.4 Directives Defined in Other Documents - +
  • 6.4 Directives Defined in Other Documents
  • 7 Security Considerations @@ -1336,6 +1332,8 @@

    [CSP-DOCUMENT] module. This includes base-uri, form-action, frame-ancestors, plugin-types, sandbox.

  • The manifest-src directive has been added.

    +
  • +

    The report-uri directive is deprecated in favor of the new report-to directive, which relies on [OOB-REPORTING] as infrastructure.

    1.4. Open Questions

      @@ -1356,9 +1354,6 @@

      -

      Sketching out a reporting framework at http://mikewest.github.io/error-reporting/ that we should probably use to resolve some of the issues with - reporting in CSP2.

    @@ -3180,15 +3175,6 @@

    New directives SHOULD use the pre-request check, post-request check, response check, and initialization hooks in order to integrate themselves into Fetch and HTML.

    -

    6.4.1. reports

    -

    The reports directive defines the endpoint to which violation - reports are sent. The syntax for the directive’s name and - value is described by the following ABNF:

    -
    directive-name  = "reports"
-directive-value = <URL> ; TODO: Figure out what to use here.
-
    -

    Finish stubbing out Not Just Error - Reporting with Ilya so we can integrate that work here.

    7. Security Considerations

    @@ -3405,7 +3391,6 @@

    attribute for SecurityPolicyViolationEvent, in §5.1
  • dict-member for SecurityPolicyViolationEventInit, in §5.1 -
  • reports, in §6.4.1
  • report-to, in §6.3.2
  • report-uri, in §6.3.1
  • resource, in §2.3 @@ -3786,8 +3771,6 @@

    Issue
    Do something interesting to the execution context in order to lock down interesting CSSOM algorithms. I don’t think CSSOM gives us any hooks here, so let’s work with them to put something reasonable together. ↵
    -
    Finish stubbing out Not Just Error - Reporting with Ilya so we can integrate that work here. ↵
    \ No newline at end of file diff --git a/index.src.html b/index.src.html index 9c192f946f..47a28f1690 100644 --- a/index.src.html +++ b/index.src.html @@ -369,6 +369,9 @@

    Changes from Level 2

    6. The `manifest-src` directive has been added. + 7. The `report-uri` directive is deprecated in favor of the new `report-to` + directive, which relies on [[OOB-REPORTING]] as infrastructure. +

    Open Questions

    1. Do we really want to remove `frame-src`? Though the threat model of @@ -386,10 +389,6 @@

    Open Questions

    risk by using the original URL of a blocked resource; there shouldn't be anything in the report JSON that script can't gather on its own by walking the DOM. - - 2. Sketching out a reporting framework at http://mikewest.github.io/error-reporting/ - that we should probably use to resolve some of the issues with - reporting in CSP2.

    • @@ -2547,21 +2546,6 @@

    post-request check, response check, and initialization hooks in order to integrate themselves into Fetch and HTML. - -

    `reports`

    - - The reports directive defines the endpoint to which violation - reports are sent. The syntax for the directive's name and - value is described by the following ABNF: - - 
    -    directive-name  = "reports"
-    directive-value = <URL> ; TODO: Figure out what to use here.
-
    - - ISSUE: Finish stubbing out - Not Just Error - Reporting with Ilya so we can integrate that work here.